feat(email): HTML branded templates with inline logo, wire remaining notification types

- All webhook emails now render as branded HTML (dark header, inline base64
  Aegis logo, card layout, CTA-button links) instead of plain text.
- Wired the 7 remaining notification-preference keys that had no trigger:
  stale coverage alerts, campaign-activated assignment emails, generic
  test-state-change steps (execution started / blue evaluating / in review),
  all-team-validation broadcasts on every lead vote, webhook delivery
  failures (3rd consecutive failure), new user registration, and background
  job errors (APScheduler global error listener).
- New notify_roles_by_email() helper for role-scoped, preference-gated,
  actor-excludable broadcasts.
- Fixed apscheduler.events stubbing gaps in several test files' sys.modules
  fakes that broke full-suite collection after adding the APScheduler
  error-listener import.

backend/tests/test_t110_evidence_router.py

@@ -74,6 +74,7 @@ for mod_name in [
     "apscheduler", "apscheduler.schedulers",
     "apscheduler.schedulers.background",
     "apscheduler.triggers", "apscheduler.triggers.cron",
+    "apscheduler.events",
 ]:
     if mod_name not in sys.modules:
         m = ModuleType(mod_name)
@@ -83,6 +84,7 @@ for mod_name in [
         elif mod_name == "botocore.exceptions": m.ClientError = Exception
         elif mod_name == "apscheduler.schedulers.background": m.BackgroundScheduler = MagicMock
         elif mod_name == "apscheduler.triggers.cron": m.CronTrigger = MagicMock
+        elif mod_name == "apscheduler.events": m.EVENT_JOB_ERROR = 1
         sys.modules[mod_name] = m
 
 # ---------------------------------------------------------------------------